From patchwork Wed Jan 24 08:18:44 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Saeed Mahameed X-Patchwork-Id: 13528773 X-Patchwork-Delegate: kuba@kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9F08917589 for ; Wed, 24 Jan 2024 08:19:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1706084346; cv=none; b=mj7PlFYRehwVurS0uFASpBgib1tvB5J6iWUaD+Xy3rMPK1urpWP5uHK7JH+oGl7+81IacyFN8HS88JmAwuftFNyUkcMkuJ/Cji4Llzo7CZ+1AfBtJhW60PVefC0RCmnPpSw5SFP4710yGfCU0RbxkcZlmFWRise/PH8yOzc8RZk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1706084346; c=relaxed/simple; bh=KLeF6Ff/3eFjKTN5iyOtyNgVUuqo8zcjymMJ4X8MiAU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mXXXyDsAo9+9WEiiahiQjyWr99BnBeSqLEfjB8kAsW60ohUzBKU0WWOnxFsHnFLHxVgjeTtu/1GDNwOBxgcrlUgX6ep1Jg5EzYG/g1cR6+WMH6E2MURJE2fFIOeRFpjRr48a5nQA7jcnEbPHkxsiLxuq0qL+0sn3lh4uLQuN/wQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=JgoE5ARn; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="JgoE5ARn" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 373C6C433F1; Wed, 24 Jan 2024 08:19:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1706084346; bh=KLeF6Ff/3eFjKTN5iyOtyNgVUuqo8zcjymMJ4X8MiAU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JgoE5ARn4g8sN5jUaAANVm+NieCSzDblIUqCjxuKOrafwzhE2NDuf5rzXY3GeEVdr sD/EcOqZ4lg6jjVnm1DbLfnAkQvZDScB82W4YbtVbkDp0U9mXb9XORTx954U8BM3+N tY9pZ85eshbhCuKa3vU1hqy2iXSAV+BLeeceaYHf0/rfwLYBkZn1S8v8Y8ndkkwNFR 1DAio9kXGPVrrY2Wz+ZTdXHISPCT4HWKb73D95tU6hlGuheIdBBj/aFcocqXDFNCur Nw7kn1NLQ8kaf+Z+T1qBCEhsYpryaItQ2KkbhVNy7lbtRpOF//LD/GtthManQCsLU6 kJ6mlElnKMsSg== From: Saeed Mahameed To: "David S. Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet Cc: Saeed Mahameed , netdev@vger.kernel.org, Tariq Toukan , Rahul Rameshbabu Subject: [net 03/14] net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context Date: Wed, 24 Jan 2024 00:18:44 -0800 Message-ID: <20240124081855.115410-4-saeed@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240124081855.115410-1-saeed@kernel.org> References: <20240124081855.115410-1-saeed@kernel.org> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org From: Rahul Rameshbabu Indirection (*) is of lower precedence than postfix increment (++). Logic in napi_poll context would cause an out-of-bound read by first increment the pointer address by byte address space and then dereference the value. Rather, the intended logic was to dereference first and then increment the underlying value. Fixes: 92214be5979c ("net/mlx5e: Update doorbell for port timestamping CQ before the software counter") Signed-off-by: Rahul Rameshbabu Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed --- drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c index c206cc0a8483..078f56a3cbb2 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c @@ -213,7 +213,7 @@ static void mlx5e_ptp_handle_ts_cqe(struct mlx5e_ptpsq *ptpsq, mlx5e_ptpsq_mark_ts_cqes_undelivered(ptpsq, hwtstamp); out: napi_consume_skb(skb, budget); - md_buff[*md_buff_sz++] = metadata_id; + md_buff[(*md_buff_sz)++] = metadata_id; if (unlikely(mlx5e_ptp_metadata_map_unhealthy(&ptpsq->metadata_map)) && !test_and_set_bit(MLX5E_SQ_STATE_RECOVERING, &sq->state)) queue_work(ptpsq->txqsq.priv->wq, &ptpsq->report_unhealthy_work);